javascript-obfuscator · sanex3339 · Jul 9, 2026 · Jul 9, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,7 @@ Change Log
 v5.4.5
 ---
 * Fixed `controlFlowFlattening` intermittently dropping arguments of a spread call (e.g. `foo(...args)`) when it reused a control flow wrapper of a same-arity plain call. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1423
+* Fixed `selfDefending` making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1421
 
 v5.4.4
 ---

diff --git a/src/custom-code-helpers/self-defending/templates/SelfDefendingTemplate.ts b/src/custom-code-helpers/self-defending/templates/SelfDefendingTemplate.ts
@@ -6,14 +6,18 @@
 export function SelfDefendingTemplate (): string {
     return `
         const {selfDefendingFunctionName} = {callControllerFunctionName}(this, function () {
+            if ({selfDefendingFunctionName}.bind().toString().indexOf('\\n') !== -1) {
+                return;
+            }
+
             return {selfDefendingFunctionName}
                 .toString()
                 .search('(((.+)+)+)+$')
                 .toString()
                 .constructor({selfDefendingFunctionName})
                 .search('(((.+)+)+)+$');
         });
-        
+
         {selfDefendingFunctionName}();
     `;
 }
diff --git a/...nctional-tests/custom-code-helpers/self-defending/templates/SelfDefendingTemplate.spec.ts b/...nctional-tests/custom-code-helpers/self-defending/templates/SelfDefendingTemplate.spec.ts
@@ -240,4 +240,43 @@ describe('SelfDefendingTemplate', function () {
             });
         });
     });
+
+    describe('Variant #6: engines that re-serialize `toString` skip the beautifier trap (issue #1421)', () => {
+        const reserializingEngineSimulation: string =
+            '(function () {' +
+                'var nativeBind = Function.prototype.bind;' +
+                'Function.prototype.bind = function () {' +
+                    'var boundFunction = nativeBind.apply(this, arguments);' +
+                    'boundFunction.toString = function () { return "function () {\\n [native code]\\n}"; };' +
+                    'return boundFunction;' +
+                '};' +
+            '})();\n';
+
+        const expectedEvaluationResult: number = 1;
+
+        let evaluationResult: number = 0;
+
+        before(() => {
+            const code: string = readFileAsString(__dirname + '/fixtures/input.js');
+
+            let obfuscatedCode: string = JavaScriptObfuscator.obfuscate(code, {
+                ...baseOptions,
+                selfDefending: true
+            }).getObfuscatedCode();
+            obfuscatedCode = beautifyCode(obfuscatedCode, 'space');
+            obfuscatedCode = `${reserializingEngineSimulation}${obfuscatedCode}`;
+
+            return evaluateInWorker(obfuscatedCode, redosEvaluationTimeout).then((result: string | null) => {
+                if (!result) {
+                    return;
+                }
+
+                evaluationResult = parseInt(result, 10);
+            });
+        });
+
+        it('should not enter code in infinity loop and evaluate correctly', () => {
+            assert.equal(evaluationResult, expectedEvaluationResult);
+        });
+    });
 });
diff --git a/test/index.spec.ts b/test/index.spec.ts
@@ -149,6 +149,7 @@ import './functional-tests/storages/string-array-transformers/string-array-stora
  * Performance tests
  */
 import './performance-tests/JavaScriptObfuscatorPerformance.spec';
+import './performance-tests/SelfDefendingRuntimePerformance.spec';
 
 /**
  * Runtime tests

diff --git a/test/performance-tests/SelfDefendingRuntimePerformance.spec.ts b/test/performance-tests/SelfDefendingRuntimePerformance.spec.ts
@@ -0,0 +1,55 @@
+import { assert } from 'chai';
+
+import { evaluateInWorker } from '../helpers/evaluateInWorker';
+
+import { JavaScriptObfuscator } from '../../src/JavaScriptObfuscatorFacade';
+
+describe('SelfDefending runtime performance', function () {
+    const reserializingEngineSimulation: string =
+        '(function () {' +
+            'var nativeToString = Function.prototype.toString;' +
+            'Function.prototype.toString = function () {' +
+                'return nativeToString.apply(this, arguments).replace(/([{;])/g, "$1\\n ");' +
+            '};' +
+        '})();\n';
+
+    const runtimeBudget: number = 5000;
+
+    let obfuscatedCode: string,
+        elapsed: number = runtimeBudget,
+        evaluationResult: number = 0;
+
+    this.timeout(30000);
+
+    before(() => {
+        const code: string = 'globalThis.selfDefendingResult = (function () { return 1; })();';
+
+        obfuscatedCode = JavaScriptObfuscator.obfuscate(code, {
+            compact: true,
+            selfDefending: true,
+            stringArray: false,
+            target: 'node'
+        }).getObfuscatedCode();
+        obfuscatedCode = `${reserializingEngineSimulation}${obfuscatedCode};globalThis.selfDefendingResult;`;
+
+        const startTime: number = Date.now();
+
+        return evaluateInWorker(obfuscatedCode, runtimeBudget).then((result: string | null) => {
+            elapsed = Date.now() - startTime;
+
+            if (!result) {
+                return;
+            }
+
+            evaluationResult = parseInt(result, 10);
+        });
+    });
+
+    it('should skip the beautifier trap and evaluate correctly (not hang) on a re-serializing engine', () => {
+        assert.equal(evaluationResult, 1);
+    });
+
+    it('should evaluate well under the ReDoS-trap runtime budget', () => {
+        assert.isBelow(elapsed, runtimeBudget);
+    });
+});
-Original file line number
+Diff line change
@@ Expand Up / @@ -3,6 +3,7 @@ Change Log @@
     v5.4.5
     ---
     * Fixed `controlFlowFlattening` intermittently dropping arguments of a spread call (e.g. `foo(...args)`) when it reused a control flow wrapper of a same-arity plain call. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1423
+    * Fixed `selfDefending` making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1421
     v5.4.4
     ---
@@ Expand Down @@